Decoder/ Claims/ scope
Registered claim

scope

In OAuth 2.0, holds the space-separated permissions granted to the token. Not formally registered, but widely used.

Type
Public claim (String)
Example
scope

Example

{ "scope": "read write" }
Try decoding a token yourselfJust paste and the header, payload and claims unfold instantly.
Open the decoder

Related

iss
Identifies the party that issued the token, usually the name or URL of the auth server. On verification, check it matches the expected issuer.
sub
Identifies the subject the token is about (typically the user). It must be unique within the issuer's scope.
aud
Indicates the intended recipients of the token. A verifier must confirm it is included in this audience.
exp
The token must not be accepted after this time. Expressed as a Unix time in seconds since 1970-01-01.
nbf
The token is not valid before this time (Not Before). Paired with exp it forms a validity window.
iat
The time the token was issued. Useful for computing token age or reissue policies.